PHP generated picture bug under IE


There is a bug in PHP when sending an image back to the user, by adding the 'image/gif' or 'image/jpeg' mime headers, only under Internet Explorer.

This makes Internet Explorer not recognize the image when we try to save it (for displaying, there is no problem), as for netscape it works fine. We can see that the output from Apache (sniffed) is malformed because it adds the following string: "c02\r\n" before sending the real datas ("GIF89a2...")

Some tests have been realised on an Apache/PHP/Java RedHat linux 7.1 server with the latest updates (apache 1.3.27) and the following observations have been made:
The C02 bug comes only with the HTTP/1.1 Protocol, and not with the HTTP/1.0. It does not depend on the header that you send for requesting the datas, but it depends on the sent back headers, if there is a 'image/gif' or 'image/jpeg' mime header, then it comes out.
The file name requested can be of any type, .php or .phtml.
The URL parameters added to the file requested after '?' do not change anything.
The bug doesn't come from Internet Explorer, because I simulated the request simply with 'GET /the_picture.php HTTP/1.1' (and the host) with a self-made request program and I received the same buggy answer !
If we change the first bytes normally sent (so 'GIF89' for example), then the c02 bug changes it's value in a random one.
If we send an image/jpeg header with a jpeg picture, it will add "e99\r\n" before the picture.

Now there is one clue more: this bug happen only when you put a "Cache-Control" header before the picture datas, else it will work fine.

All this disturbes Internet Explorer a lot when the user tries to save the picture. It will then suggest the BMP format, with no other possibility, and missing the filename. This is very annoying.

Please try to download this picture below with Internet Explorer (all versions 4 to 6) by right-clicking on it, and selecting 'save as'. Then you will see that the dialog box will suggest you '.bmp' and nothing else, without the image name and other bugs..

This is the picture generated with PHP:



Here is the code that will generate this bug.
This code will just read an existing gif picture, and send the content to the user.

<?
header("Content-type: image/gif");
header("Cache-Control: no-cache, must-revalidate");
$output="bird.gif"; // file name
$fd = fopen($output,"r");
$filelength=filesize($output);
$contents = fread($fd,$filelength);
echo $contents; fclose($fd);
?>

In fact, this is a very serious and common bug that many people had up to now, but nobody thought it was PHP, everybody thinks it's IE !!
To have an idea, search for 'save as bmp only' at google's group search.

Thanks for looking to this bug and for your help..

My e-mail: dan1@edenpics.com